Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

Watermarking Generative Categorical Data

T0 review · 4 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper argues that generative categorical data can be watermarked at the distribution level: replacing a row's Y value with a secret-hash-derived value with probability p_w embeds a verifiable signal that survives regeneration by a…

desk verdict A clean distribution-level insertion/inverse idea for categorical data, but the detector as written needs the unwatermarked synthetic distribution the owner is told not to keep, so the headline verification claim is not yet supported. read the letter →

arxiv 2411.10898 v1 pith:KNS36BHK submitted 2024-11-16 cs.CR cs.LG

Bochao Gu , Hengzhi He , Guang Cheng This is my paper · ORCID
classification cs.CRcs.LG
keywords distribution-levelwatermarkingcategoricaldatagenerativetabulartotalvariationdistancehypothesistestingsyntheticprovenancesecret-keyhashwatermark
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Generative models can learn a categorical table's distribution and emit new tables that are statistically similar but different in their specific rows, so row-level watermarks do not survive. The authors argue that watermarking should therefore act on the distribution itself: split the columns into $X$ and $Y$, and with probability $p_w$ replace each $Y$ value by a secret-hash-derived value computed from the matching $X$ value. Detection applies an inverse of that insertion and compares the recovered distribution with the original using total variation distance. If a synthesizer regenerates data from the watermarked distribution, the mark is still present and detectable without knowing which rows were modified. The paper proves the watermark-induced distribution shift is at most $p_w$ and demonstrates detection in simulations, including after regeneration by a tabular synthesizer.

What carries the argument

The load-bearing object is the pair of injective category-to-integer mappings $M_Y$ and $M_Y^{-1}$, built from the original table's $Y$ columns, together with a secret-keyed one-way hash $\mathrm{Hash}^{\mathrm{secret}}_{\#(Y)}$. The insertion algorithm replaces each row's $Y$ value with $M_Y^{-1}(\mathrm{Hash}^{\mathrm{secret}}_{\#(Y)}(X))$ with probability $p_w$. The detection machinery is the insertion inverse: for each $x$, if the hash of $x$ equals the observed $Y$ code, the recovered conditional probability is $(\Pr(\hat Y=y\mid X=x)-p_w)/(1-p_w)$; otherwise it is $\Pr(\hat Y=y\mid X=x)/(1-p_w)$. This reconstruction, together with the marginal of $X$, yields the estimated joint distribution $D_{\mathrm{inv}}$. The final hypothesis test samples candidate distributions from a prior (a Dirichlet distribution in the experiments), applies the same inverse to each, and rejects the null that the suspicious table is unwatermarked when its total variation distance to the original is small.

What would settle it

Run any tabular synthesizer on a watermarked table and then either add a new category to a $Y$ column or delete all rows of its least common category before running the detector; the paper's simulations include no such support mismatch, and the inverse mapping is only defined on the original support.

Watch

Extended reading notes

Core claim

The central claim is that a watermark can be embedded in a categorical distribution rather than in specific rows. Let the table be split column-wise into $X$ and $Y$, with an injective map $M_Y$ sending each category of $Y$ to an integer. With independent probability $p_w$, the inserter replaces a row's $Y$ entry by $M_Y^{-1}(\mathrm{Hash}^{\mathrm{secret}}_{\#(Y)}(X))$, where the hash maps the $X$ part to one of the $\#(Y)$ category codes. The watermarked distribution $\hat Y$ is therefore a mixture of the original $Y$ and the hash-decoded distribution, with weights $1-p_w$ and $p_w$. The insertion inverse recovers the original conditional law of $Y$ given $X$ by subtracting $p_w$ and dividing by $1-p_w$ when the hash hits the observed $Y$ value, and dividing by $1-p_w$ otherwise; rebuilding the joint distribution gives $D_{\mathrm{inv}}$. The detector then compares $D_{\mathrm{inv}}$ with the original $D$ using total variation distance and calibrates the comparison by sampling tables from a prior, reporting a $p$-value against the null that the suspicious table is not watermarked. In the simulations reported, the $p$-values are zero and $d_{\mathrm{TV}}(D_{\mathrm{inv}},D)$ stays small, while Theorem 3.1 bounds the utility cost by $d_{\mathrm{TV}}(D,\hat D)\le p_w$.

Load-bearing premise

The synthetic distribution $Y$ must have exactly the same category support as the original $Y$; if a synthesizer creates a new category or deletes an existing one, the inverse decoder cannot be applied to every row and the detection formula no longer holds.

Editorial extensions

If this is right

  • If a buyer trains a new synthesizer on a watermarked table, tables regenerated from it remain detectable, provided the synthesizer preserves the conditional distribution of $Y$ given $X$.
  • Any attack that only reorders rows or deletes random rows leaves the distribution, and therefore the watermark, intact.
  • The owner can tune $p_w$ to trade utility against detectability, since Theorem 3.1 guarantees the total variation distance between the watermarked and unwatermarked distributions is at most $p_w$.
  • Even a white-box adversary who knows the algorithm cannot remove the mark without guessing the secret hash outputs; the paper estimates the probability of guessing all of them as about $1/(\#(Y)^{\#(X)})$.
  • The pseudorandom mapping variant preserves the marginal distributions of both $X$ and $Y$, perturbing only their dependence, which suits buyers who need the marginal law of $Y$ unchanged.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the mark lives in the conditional law of $Y$ given $X$, any post-processing that preserves that conditional law should preserve detectability, while any processing that smooths or flattens the conditionals will erode it even if the marginals are untouched. (Editorial inference.)
  • If real synthesizers sometimes add or drop categories, a natural extension is to reserve an 'other' bucket in $M_Y$ and run the inverse only on rows whose $Y$ value lies in the original support; the paper does not test this regime. (Editorial inference.)
  • The sparse-column method suggests a broader design principle: watermark only low-cardinality, high-mutual-information columns to keep the inverse estimator stable, and automatic selection of such columns is an obvious next step. (Editorial inference.)
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a distribution-level watermarking scheme for categorical synthetic data. A data owner with original table Tori and a synthesizer S that generates tables T with distribution D splits each row into X and Y components. During insertion, each Y value is replaced with probability pw by M_Y^{-1}(Hash_secret(X)), producing a watermarked distribution. Detection applies an inverse algorithm to a suspicious table T' to recover an estimate Dinv of the pre-watermark distribution, and then tests whether Dinv is close to the original distribution using total variation distance. The paper presents a bound on the induced distribution shift, an informal security argument based on one-way hashes, and simulations reporting true and false positive rates. Two extensions are proposed: a sparse-column method for high-dimensional categorical spaces and a pseudorandom mapping variant that preserves marginal distributions.

Significance. If the scheme worked as stated, it would fill a real gap: most categorical watermarking methods are designed for static tables and do not survive regeneration by a synthesizer. The core insertion-inverse algebra is simple and likely correct under the ideal assumptions that the synthesizer exactly preserves the support of Y and that the owner has access to the unwatermarked synthetic distribution D. The paper also correctly identifies the usefulness of distribution-level verification and provides a bound that is plausible. However, the detection protocol as written is not implementable with the data the protocol says the owner retains, the support-mismatch assumption is untested and load-bearing, and the hypothesis-testing pseudocode is internally inconsistent. These issues mean that the central claim of reliable verification in the generative-data setting is not established by the current manuscript.

major comments (4)
  1. [Section 3.1 and Algorithm 4] The detection procedure requires the unwatermarked synthetic distribution D, but the protocol explicitly states that the owner retains only Tori and the secret list. Algorithm 4 step 4 says 'Use T', T, and M_secret_D to build Vec_secret(D') and Vec_secret(D)' without T being an input or retained. If T is understood as Tori, then the comparison becomes dTV(Dinv, Dori), which conflates the watermark signal with the synthesizer's fidelity error; the insertion-inverse recovers D, not Dori. None of the experiments test the owner-only-Tori setting; instead, Tables 2-4 compare Dinv with the known simulation distribution D, and Simulation 4 compares against D as well. The paper's headline claim of verification from Tori alone is therefore unsupported.
  2. [Section 3.2, 3.3] The inverse decoder applies the mapping M_Y and M_Y^{-1} constructed from Tori,y to all samples in Ty, requiring Y and Yori to have identical support. The paper states this assumption but does not test it. Real synthesizers often drop rare categories or produce new combinations, and Simulation 4 with TabSyn does not report whether the support of Ty was preserved. If the support changes, the hash-decoding formula cannot be applied to all samples, so the detector is undefined on those rows. The claimed suitability for modern generative models is therefore conditional on an untested, restrictive assumption.
  3. [Algorithm 4, Section 3.3] The hypothesis-testing part of Algorithm 4 is internally inconsistent. Line 6 computes d = dTV(D, D') rather than dTV(Dinv, D), even though the surrounding text and Section 3.3 say the comparison is between D and Dinv. Similarly, line 11 computes dsam = dTV(Dsam, D') instead of dTV(Dsam,inv, D'), so the null distribution of the test statistic is not defined. The p-value calculation and the reported FPR results therefore do not correspond to the stated procedure, making the empirical significance claims unverifiable from the algorithm as written.
  4. [Algorithm 3, Section 3.3] The insertion-inverse formula divides by (1 - pw) and can produce negative probabilities when the empirical conditional probability Pr(Y' = y | X = x) is smaller than pw for the hashed category (or when sample noise makes the numerator negative). The paper does not specify how negative entries are handled (e.g., clipping, renormalization) before computing total variation distance. Without such a rule, the algorithm is not well-defined for finite samples, and the small reported dTV values cannot be reproduced from the given description.
minor comments (4)
  1. [Section 3.4, Theorem 3.1] In the proof of Theorem 3.1, the line 'dTV(Y, \hat{Y})' should be 'dTV(D, \hat{D})' since the statement concerns the joint distribution D. Also, the definitions of p_i and q_i are imprecise about the role of M_secret_D(D); clarify that the events are over the random draw from the distribution.
  2. [Section 4.2, Simulation 1] The text says 'X = [X1, X2], where X1 and X2, and X3 are identical and independently distributions'; this appears to be a typo, since X3 is not part of X in that simulation. Please correct the description of the simulated distribution.
  3. [Algorithm 5, Section 5.1] Line 7 of the XYExtractor algorithm says 'Enumerate each combination of ydim columns in Ttx' but this should be 'in Tty', since the β combinations are for the Y side.
  4. [Section 3.3, Definition 3.1] The total variation distance is defined correctly, but the statement that 'D and Dinv share the same support' should be justified; if the support of the suspicious distribution differs from that of the original, additional handling is needed, which relates to the support-mismatch issue raised above.

Circularity Check

2 steps flagged · score 6.0 of 10

The core detection success is the algebraic inverse of the insertion rule, and the owner-only protocol is validated only with the hidden insertion-time distribution D.

  1. self definitional [Section 3.3, 'Insertion Inverse Algorithm', and Section 4.2, Tables 2-4]
    "If M_Y^{-1}(Hash_secret(x)) ≠ y, then Pr(\hat Y_secret = y|X=x) = (1−pw) Pr(Y=y|X=x)... If M_Y(Hash_secret(x)) =y, then Pr(\hat Y_secret = y|X=x) = Pr(Y=y|X=x) + pw Pr(Y≠y|X=x). ... To assess the accuracy of our watermarking scheme, we simulated the distribution D onto which we will embed the watermark."

    Algorithm 3 solves these two equations for Pr(Y|X) using the same pw: it substitutes (Pr(Y'=y|X'=x)−pw)/(1−pw) when the hashed value equals y, and Pr(Y'=y|X'=x)/(1−pw) otherwise. Hence, for an unmodified watermarked distribution D' = \hat D_secret, the insertion inverse returns D exactly in expectation. The true-positive experiments (Tables 2-4) then measure d_TV(Dinv, D) with the very D that was used as the insertion input. The reported closeness is therefore the algebraic inversion of a known transform plus finite-sample estimation error, not an independent test of a prediction.

  2. other [Algorithm 4, step 4, and Section 3.1]
    "Use T', T, and M_secret_D to build Vec_secret(D') and Vec_secret(D). ... the data owner only needs T when inserting the watermark and Tori during detection. In practice, the data owner only retains Tori and a list of secrets."

    The detector as written requires the pre-watermark synthetic table T (or its distribution D), but the stated protocol says the owner retains only Tori. All true-positive simulations supply this hidden T/D and compare Dinv with the same D used for insertion. If T is replaced by the only retained table, Tori, the test statistic becomes d_TV(Dinv, Dori), which conflates watermark recovery with synthesizer fidelity and is never evaluated. Thus the central claim that verification is possible from Tori alone is not supported by the experiments; the validation is in-sample because the ground-truth D is exactly the insertion-time input, not an independently available quantity.

full rationale

The paper's mathematical derivation of the insertion inverse is internally consistent, but the central detection experiment is a self-consistency check rather than an independent prediction: the inverse formulas are obtained by solving the insertion formulas, so unmodified watermarked data is recovered by construction. The true-positive simulations use the same simulated D that the watermark was inserted into, making the near-zero d_TV(Dinv,D) values a measure of finite-sample inversion accuracy, not evidence for the owner-only protocol. The TabSyn regeneration experiment (Simulation 4) is the one independent-looking result, but even it compares against the known pre-watermark D rather than the retained Tori. There is no load-bearing self-citation or imported uniqueness theorem; the related-work citation [19] is not used to justify the method. The more serious gap is the Algorithm 4 input inconsistency: the detector requires T although the protocol says only Tori is retained, which is a correctness risk rather than a circularity per se. The false-positive-rate section also advises designing the prior after testing the data, which limits the statistical claim but is transparently stated. Overall, partial circularity is present because the headline detection claim reduces, on unmodified watermarked data, to applying the inverse of the insertion operator and comparing with the operator's own input.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central scheme rests on five background premises: identical support between the synthetic and original Y distributions, availability of the unwatermarked D at detection time, the one-way uniform behavior of the secret hash, a well-specified two-distribution hypothesis test, and i.i.d. rows with an independent Bernoulli selector. None of these is derived in the paper; pw and the Dirichlet prior are free parameters chosen by the data owner. No new physical or mathematical entities are introduced.

free parameters (3)
  • pw (watermark probability) = 0.05, 0.1, 0.15, 0.3 in simulations; chosen by owner in deployment
    Controls how often Y is replaced by Hash_secret(X); appears directly in the inverse formula and in the TV bound, so the central claim depends on this hand-chosen value.
  • Dirichlet prior concentration alpha = 0.1 (Simulations 1-3 and 4) and 0.03 (Simulations 5-6), vector length equal to #(D)
    Defines the null distribution for hypothesis testing; Section 4.3 advises tuning it to control FPR, making it a fitted parameter rather than a fixed input.
  • xdim, ydim (sparse-column method) = user-selected integers in [1, M] and [1, N]
    Hand-selected to shrink the categorical support; no principled selection rule is given, and detection performance depends on them.
assumptions (5)
  • domain assumption D and Dori have identical support on the Y columns.
    Section 3.2 states the inserter requires the synthesizer to neither create new categories nor delete existing categories in Ty; if violated, M_Y and the inverse formula cannot be applied.
  • domain assumption The data owner has the unwatermarked distribution D or table T available at detection time.
    Algorithm 4 step 4 calls for T to build Vec(D), while Section 3.1 says only Tori is retained; the dTV(D,D') comparison is undefined without D.
  • domain assumption Hash_secret(x) behaves as a one-way function with uniform output over the support of Y.
    Section 3.4 relies on uniformity for the 1/#(Y)^#(X) adversarial guessing bound and says a rigorous proof is deferred; only small empirical checks in Figures 1-3 are given.
  • domain assumption The suspicious table T' is generated either from the chosen prior or from the watermarked distribution with the known secret and pw.
    The hypothesis test only compares these two worlds; other generative or adversarial processes are outside the test's scope.
  • domain assumption Rows of T are independent draws from D, and the Bernoulli selector B is independent of the data.
    Algorithm 1 draws B independently for each row; i.i.d. sampling is assumed in the TV calculations and in the synthetic simulations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Watermarking Generative Categorical Data." pith.science (2026). https://pith.science/paper/KNS36BHK

@misc{pith2026241110898,
  author       = {Pith},
  title        = {Pith review of: Watermarking Generative Categorical Data},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KNS36BHK}},
  note         = {Machine review of arXiv:2411.10898}
}
read the original abstract

In this paper, we propose a novel statistical framework for watermarking generative categorical data. Our method systematically embeds pre-agreed secret signals by splitting the data distribution into two components and modifying one distribution based on a deterministic relationship with the other, ensuring the watermark is embedded at the distribution-level. To verify the watermark, we introduce an insertion inverse algorithm and detect its presence by measuring the total variation distance between the inverse-decoded data and the original distribution. Unlike previous categorical watermarking methods, which primarily focus on embedding watermarks into a given dataset, our approach operates at the distribution-level, allowing for verification from a statistical distributional perspective. This makes it particularly well-suited for the modern paradigm of synthetic data generation, where the underlying data distribution, rather than specific data points, is of primary importance. The effectiveness of our method is demonstrated through both theoretical analysis and empirical validation.

Figures

Figures reproduced from arXiv: 2411.10898 by the authors.

Figure 1
Figure 1. #(Y ) = 3, samples 12000 secret, x = [2, 2, 2, 23] [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. #(Y ) = 5, samples 12000 secret, x = [2, 24, 2, 23] [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. #(Y ) = 10, samples 12000 secret, x = [233, 2, 2, 23] [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (4 more)
Figure 5
Figure 5. Figure 5: dT V (D, D−1 attack,m) of replacement attack pw = 0.05 [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: p values of replacement attack pw = 0.1 [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: dT V (D, D−1 attack,m) of replacement attack pw = 0.1 Notice that in the first hundred iterations of the attack, the total variation distance between D −1 attack,m and D re￾mains relatively small. This demonstrates the robustness of our watermarking scheme. After 200 i…
Figure 4
Figure 4. Figure 4: p values of replacement attack pw = 0.05 [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. RaMark: Radioactive Watermarking for Generated Tabular Data

    cs.CR 2026-07 conditional novelty 7.0 of 10

    A sinusoidal dependency embedded as part of the tabular distribution remains detectable after generative retraining and data-modification attacks while utility is preserved.

Reference graph

Works this paper leans on

38 extracted references · 29 canonical work pages · cited by 1 Pith paper

  1. [1]

    Generative adversarial nets,

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial nets,” Advances in neural information processing systems , vol. 27, 2014

    2014

  2. [2]

    Score-based generative modeling through stochastic differential equations,

    Y . Song, J. Sohl-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole, “Score-based generative modeling through stochastic differential equations,” arXiv preprint arXiv:2011.13456 , 2020

    arXiv 2011

  3. [3]

    Consistency models,

    Y . Song, P. Dhariwal, M. Chen, and I. Sutskever, “Consistency models,” in International Conference on Machine Learning. PMLR, 2023, pp. 32 211–32 252

    work page 2023

  4. [4]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat et al. , “Gpt-4 technical report,” arXiv preprint arXiv:2303.08774 , 2023

    arXiv 2023

  5. [5]

    The llama 3 herd of models,

    A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Yang, A. Fan et al. , “The llama 3 herd of models,” arXiv preprint arXiv:2407.21783 , 2024

    arXiv 2024

  6. [6]

    Pre-trained language models for text generation: A survey,

    J. Li, T. Tang, W. X. Zhao, J.-Y . Nie, and J.-R. Wen, “Pre-trained language models for text generation: A survey,” ACM Computing Surveys, vol. 56, no. 9, pp. 1–39, 2024

    work page 2024

  7. [7]

    Latent diffusion energy-based model for interpretable text modeling

    P. Yu, S. Xie, X. Ma, B. Jia, B. Pang, R. Gao, Y . Zhu, S.-C. Zhu, and Y . Wu, “Latent diffusion energy-based model for interpretable text modeling.” in International Conference on Machine Learning (ICML 2022)., 2022

    work page 2022

  8. [8]

    Modeling tabular data using conditional gan,

    L. Xu, M. Skoularidou, A. Cuesta-Infante, and K. Veeramachaneni, “Modeling tabular data using conditional gan,” Advances in neural information processing systems , vol. 32, 2019

    2019

Show all 38 references
  1. [9]

    Tabd- dpm: Modelling tabular data with diffusion models,

    A. Kotelnikov, D. Baranchuk, I. Rubachev, and A. Babenko, “Tabd- dpm: Modelling tabular data with diffusion models,” in International Conference on Machine Learning. PMLR, 2023, pp. 17 564–17 579

    2023

  2. [10]

    Mixed-type tabular data synthesis with score-based diffusion in latent space,

    H. Zhang, J. Zhang, Z. Shen, B. Srinivasan, X. Qin, C. Faloutsos, H. Rangwala, and G. Karypis, “Mixed-type tabular data synthesis with score-based diffusion in latent space,” in The Twelfth International Conference on Learning Representations

  3. [11]

    Missdiff: Training dif- fusion models on tabular data with missing values,

    Y . Ouyang, L. Xie, C. Li, and G. Cheng, “Missdiff: Training dif- fusion models on tabular data with missing values,” arXiv preprint arXiv:2307.00467, 2023

    2023 arXiv

  4. [12]

    Tabular data generation using binary diffusion,

    V . Kinakh and S. V oloshynovskiy, “Tabular data generation using binary diffusion,” arXiv preprint arXiv:2409.13882 , 2024

    2024 arXiv

  5. [13]

    Synthetic data applications in finance,

    V . K. Potluru, D. Borrajo, A. Coletta, N. Dalmasso, Y . El-Laham, E. Fons, M. Ghassemi, S. Gopalakrishnan, V . Gosai, E. Krea ˇci´c et al. , “Synthetic data applications in finance,” arXiv preprint arXiv:2401.00081, 2023

    2023 arXiv

  6. [14]

    Synthetic data in machine learning for medicine and healthcare,

    R. J. Chen, M. Y . Lu, T. Y . Chen, D. F. Williamson, and F. Mahmood, “Synthetic data in machine learning for medicine and healthcare,” Nature Biomedical Engineering , vol. 5, no. 6, pp. 493–497, 2021

    2021

  7. [15]

    Tree-rings watermarks: Invisible fingerprints for diffusion images,

    Y . Wen, J. Kirchenbauer, J. Geiping, and T. Goldstein, “Tree-rings watermarks: Invisible fingerprints for diffusion images,” in Thirty- seventh Conference on Neural Information Processing Systems, 2023. [Online]. Available: https://openreview.net/forum?id=Z57JrmubNl

    2023

  8. [16]

    Provable robust watermarking for ai-generated text,

    X. Zhao, P. V . Ananth, L. Li, and Y .-X. Wang, “Provable robust watermarking for ai-generated text,” in The Twelfth International Conference on Learning Representations , 2023

    2023

  9. [17]

    A watermark for large language models,

    J. Kirchenbauer, J. Geiping, Y . Wen, J. Katz, I. Miers, and T. Gold- stein, “A watermark for large language models,” in International Conference on Machine Learning. PMLR, 2023, pp. 17 061–17 084

    2023

  10. [18]

    Undetectable watermarks for language models,

    M. Christ, S. Gunn, and O. Zamir, “Undetectable watermarks for language models,” in The Thirty Seventh Annual Conference on Learning Theory. PMLR, 2024, pp. 1125–1139

    2024

  11. [19]

    Watermarking generative tabular data,

    H. He, P. Yu, J. Ren, Y . N. Wu, and G. Cheng, “Watermarking generative tabular data,” arXiv preprint arXiv:2405.14018 , 2024

    2024 arXiv

  12. [20]

    Tabularmark: Watermarking tabular datasets for machine learning,

    Y . Zheng, H. Xia, J. Pang, J. Liu, K. Ren, L. Chu, Y . Cao, and L. Xiong, “Tabularmark: Watermarking tabular datasets for machine learning,” arXiv preprint arXiv:2406.14841 , 2024

    2024 arXiv

  13. [21]

    Ripple watermarking for latent tabular diffusion models,

    J. Tang, “Ripple watermarking for latent tabular diffusion models,” 2024

    2024

  14. [22]

    Tamper detection and localization for categorical data using fragile watermarks,

    Y . Li, H. Guo, and S. Jajodia, “Tamper detection and localization for categorical data using fragile watermarks,” in Proceedings of the 4th ACM workshop on Digital rights management , 2004, pp. 73–82

    2004

  15. [23]

    Watermarking relational databases,

    R. Agrawal and J. Kiernan, “Watermarking relational databases,” in VLDB’02: Proceedings of the 28th International Conference on Very Large Databases. Elsevier, 2002, pp. 155–166

    2002

  16. [24]

    Plmmark: a secure and robust black-box watermarking framework for pre- trained language models,

    P. Li, P. Cheng, F. Li, W. Du, H. Zhao, and G. Liu, “Plmmark: a secure and robust black-box watermarking framework for pre- trained language models,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 37, no. 12, 2023, pp. 14 991–14 999

    2023

  17. [25]

    Three bricks to consolidate watermarks for large language models,

    P. Fernandez, A. Chaffin, K. Tit, V . Chappelier, and T. Furon, “Three bricks to consolidate watermarks for large language models,” in 2023 IEEE International Workshop on Information Forensics and Security (WIFS). IEEE, 2023, pp. 1–6

    2023

  18. [26]

    Watermarking gpt outputs,

    S. Aaronson and H. Kirchner, “Watermarking gpt outputs,” 2023

    2023

  19. [27]

    Permute-and-flip: An opti- mally robust and watermarkable decoder for llms,

    X. Zhao, L. Li, and Y .-X. Wang, “Permute-and-flip: An opti- mally robust and watermarkable decoder for llms,” arXiv preprint arXiv:2402.05864, 2024

    2024 arXiv

  20. [28]

    GumbelSoft: Diversified language model watermarking via the GumbelMax-trick,

    J. Fu, X. Zhao, R. Yang, Y . Zhang, J. Chen, and Y . Xiao, “GumbelSoft: Diversified language model watermarking via the GumbelMax-trick,” in Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , L.-W. Ku, A. Martins, ...

    2024

  21. [29]

    Tree-rings watermarks: Invisible fingerprints for diffusion images,

    Y . Wen, J. Kirchenbauer, J. Geiping, and T. Goldstein, “Tree-rings watermarks: Invisible fingerprints for diffusion images,” Advances in Neural Information Processing Systems , vol. 36, 2024

    2024

  22. [30]

    The stable signature: Rooting watermarks in latent diffusion models,

    P. Fernandez, G. Couairon, H. J ´egou, M. Douze, and T. Furon, “The stable signature: Rooting watermarks in latent diffusion models,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 22 466–22 477

    2023

  23. [31]

    Fingerprinting relational databases: Schemes and specialties,

    Y . Li, V . Swarup, and S. Jajodia, “Fingerprinting relational databases: Schemes and specialties,” IEEE Transactions on Dependable and Secure Computing, vol. 2, no. 1, pp. 34–45, 2005

    2005

  24. [32]

    Second-lsb-dependent robust wa- termarking for relational database,

    X. Xiao, X. Sun, and M. Chen, “Second-lsb-dependent robust wa- termarking for relational database,” in Third international symposium on information assurance and security . IEEE, 2007, pp. 292–300

    2007

  25. [33]

    Constructing a virtual primary key for fingerprinting relational data,

    Y . Li, V . Swarup, and S. Jajodia, “Constructing a virtual primary key for fingerprinting relational data,” in Proceedings of the 3rd ACM workshop on Digital rights management , 2003, pp. 133–141

    2003

  26. [34]

    A double fragmentation approach for improving virtual primary key- based watermark synchronization,

    M. L. P. Gort, C. Feregrino-Uribe, A. Cortesi, and F. Fern ´andez-Pe˜na, “A double fragmentation approach for improving virtual primary key- based watermark synchronization,” IEEE Access, vol. 8, pp. 61 504– 61 516, 2020

    2020

  27. [35]

    Noise-robust water- marking for numerical datasets,

    F. Seb ´e, J. Domingo-Ferrer, and A. Solanas, “Noise-robust water- marking for numerical datasets,” in Modeling Decisions for Artificial Intelligence: Second International Conference, MDAI 2005, Tsukuba, Japan, July 25-27, 2005. Proceedings 2 . Springer, 2005, pp. 134– 143

    2005

  28. [36]

    A robust database watermarking scheme that preserves statistical char- acteristics,

    Z. Ren, H. Fang, J. Zhang, Z. Ma, R. Lin, W. Zhang, and N. Yu, “A robust database watermarking scheme that preserves statistical char- acteristics,” IEEE Transactions on Knowledge and Data Engineering, 2023

    2023

  29. [37]

    Adaptive and robust watermark for generative tabular data,

    D. D. Ngo, D. Scott, S. Obitayo, V . K. Potluru, and M. Veloso, “Adaptive and robust watermark for generative tabular data,” arXiv preprint arXiv:2409.14700, 2024

    2024 arXiv

  30. [5808]

    Available: https://aclanthology.org/2024.acl-long.315

    [Online]. Available: https://aclanthology.org/2024.acl-long.315

    2024

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.